Getting Data In

Can you help me troubleshoot my issue involving sending data to output queue(parsing queue)?

ankithnageshshe
Path Finder

Hello Splunkers,

Lately, we have been facing issues in on-boarding data due to the “Could not send…..parsing queue full” issue whenever there is a data burst.

We have been setting maxkbps in limits.conf to unlimited(0) and parsing queue size to 10 MB from 512kb temporarily as a workaround.

What is the Splunk recommended best practice to address this issue?

Splunk universal forwarder version - 6.4

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @ankithnageshshetty,

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

vinkumar_splunk
Splunk Employee
Splunk Employee

Check the below link:

https://answers.splunk.com/answers/5590/could-not-send-data-to-the-output-queue.html

Most cases this occur due to congestion on the indexer side. you need to look into the "QUEUES" and sort out based on which queue is filled.

For example, look for line breaking/truncating for parsing queue; dateparserververbose for aggregation queue, regex for typing queue and check the IOPS value ( random seeks ) if the indexing queue is filled, ensure that you have 800 IOPS value on the indexer.

DId the temporary workaround helped?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...